| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 // FIXME(dominicc): Poor confused check-webkit-style demands Attribute.h here. | 5 // FIXME(dominicc): Poor confused check-webkit-style demands Attribute.h here. |
| 6 #include "core/dom/Attribute.h" | 6 #include "core/dom/Attribute.h" |
| 7 | 7 |
| 8 #include "core/HTMLNames.h" | 8 #include "core/HTMLNames.h" |
| 9 #include "core/SVGNames.h" | 9 #include "core/SVGNames.h" |
| 10 #include "core/XLinkNames.h" | 10 #include "core/XLinkNames.h" |
| (...skipping 163 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 174 | 174 |
| 175 // Unit tests | 175 // Unit tests |
| 176 | 176 |
| 177 // stripScriptingAttributes inspects animation attributes for | 177 // stripScriptingAttributes inspects animation attributes for |
| 178 // javascript: URLs. This check could be defeated if strings supported | 178 // javascript: URLs. This check could be defeated if strings supported |
| 179 // addition. If this test starts failing you must strengthen | 179 // addition. If this test starts failing you must strengthen |
| 180 // Element::stripScriptingAttributes, perhaps to strip all | 180 // Element::stripScriptingAttributes, perhaps to strip all |
| 181 // SVG animation attributes. | 181 // SVG animation attributes. |
| 182 TEST(UnsafeSVGAttributeSanitizationTest, stringsShouldNotSupportAddition) | 182 TEST(UnsafeSVGAttributeSanitizationTest, stringsShouldNotSupportAddition) |
| 183 { | 183 { |
| 184 RefPtrWillBeRawPtr<Document> document = Document::create(); | 184 RawPtr<Document> document = Document::create(); |
| 185 RefPtrWillBeRawPtr<SVGElement> target = SVGAElement::create(*document); | 185 RawPtr<SVGElement> target = SVGAElement::create(*document); |
| 186 RefPtrWillBeRawPtr<SVGAnimateElement> element = SVGAnimateElement::create(*d
ocument); | 186 RawPtr<SVGAnimateElement> element = SVGAnimateElement::create(*document); |
| 187 element->setTargetElement(target.get()); | 187 element->setTargetElement(target.get()); |
| 188 element->setAttributeName(XLinkNames::hrefAttr); | 188 element->setAttributeName(XLinkNames::hrefAttr); |
| 189 | 189 |
| 190 // Sanity check that xlink:href was identified as a "string" attribute | 190 // Sanity check that xlink:href was identified as a "string" attribute |
| 191 EXPECT_EQ(AnimatedString, element->animatedPropertyType()); | 191 EXPECT_EQ(AnimatedString, element->animatedPropertyType()); |
| 192 | 192 |
| 193 EXPECT_FALSE(element->animatedPropertyTypeSupportsAddition()); | 193 EXPECT_FALSE(element->animatedPropertyTypeSupportsAddition()); |
| 194 } | 194 } |
| 195 | 195 |
| 196 TEST( | 196 TEST( |
| 197 UnsafeSVGAttributeSanitizationTest, | 197 UnsafeSVGAttributeSanitizationTest, |
| 198 stripScriptingAttributes_animateElement) | 198 stripScriptingAttributes_animateElement) |
| 199 { | 199 { |
| 200 Vector<Attribute> attributes; | 200 Vector<Attribute> attributes; |
| 201 attributes.append(Attribute(XLinkNames::hrefAttr, "javascript:alert()")); | 201 attributes.append(Attribute(XLinkNames::hrefAttr, "javascript:alert()")); |
| 202 attributes.append(Attribute(SVGNames::fromAttr, "/home")); | 202 attributes.append(Attribute(SVGNames::fromAttr, "/home")); |
| 203 attributes.append(Attribute(SVGNames::toAttr, "javascript:own3d()")); | 203 attributes.append(Attribute(SVGNames::toAttr, "javascript:own3d()")); |
| 204 | 204 |
| 205 RefPtrWillBeRawPtr<Document> document = Document::create(); | 205 RawPtr<Document> document = Document::create(); |
| 206 RefPtrWillBeRawPtr<Element> element = SVGAnimateElement::create(*document); | 206 RawPtr<Element> element = SVGAnimateElement::create(*document); |
| 207 element->stripScriptingAttributes(attributes); | 207 element->stripScriptingAttributes(attributes); |
| 208 | 208 |
| 209 EXPECT_EQ(2ul, attributes.size()) << | 209 EXPECT_EQ(2ul, attributes.size()) << |
| 210 "One of the attributes should have been stripped."; | 210 "One of the attributes should have been stripped."; |
| 211 EXPECT_EQ(XLinkNames::hrefAttr, attributes[0].name()) << | 211 EXPECT_EQ(XLinkNames::hrefAttr, attributes[0].name()) << |
| 212 "The 'xlink:href' attribute should not have been stripped from " | 212 "The 'xlink:href' attribute should not have been stripped from " |
| 213 "<animate> because it is not a URL attribute of <animate>."; | 213 "<animate> because it is not a URL attribute of <animate>."; |
| 214 EXPECT_EQ(SVGNames::fromAttr, attributes[1].name()) << | 214 EXPECT_EQ(SVGNames::fromAttr, attributes[1].name()) << |
| 215 "The 'from' attribute should not have been strippef from <animate> " | 215 "The 'from' attribute should not have been strippef from <animate> " |
| 216 "because its value is innocuous."; | 216 "because its value is innocuous."; |
| 217 } | 217 } |
| 218 | 218 |
| 219 TEST( | 219 TEST( |
| 220 UnsafeSVGAttributeSanitizationTest, | 220 UnsafeSVGAttributeSanitizationTest, |
| 221 isJavaScriptURLAttribute_xlinkHrefContainingJavascriptURL) | 221 isJavaScriptURLAttribute_xlinkHrefContainingJavascriptURL) |
| 222 { | 222 { |
| 223 Attribute attribute(XLinkNames::hrefAttr, "javascript:alert()"); | 223 Attribute attribute(XLinkNames::hrefAttr, "javascript:alert()"); |
| 224 RefPtrWillBeRawPtr<Document> document = Document::create(); | 224 RawPtr<Document> document = Document::create(); |
| 225 RefPtrWillBeRawPtr<Element> element = SVGAElement::create(*document); | 225 RawPtr<Element> element = SVGAElement::create(*document); |
| 226 EXPECT_TRUE( | 226 EXPECT_TRUE( |
| 227 element->isJavaScriptURLAttribute(attribute)) << | 227 element->isJavaScriptURLAttribute(attribute)) << |
| 228 "The 'a' element should identify an 'xlink:href' attribute with a " | 228 "The 'a' element should identify an 'xlink:href' attribute with a " |
| 229 "JavaScript URL value as a JavaScript URL attribute"; | 229 "JavaScript URL value as a JavaScript URL attribute"; |
| 230 } | 230 } |
| 231 | 231 |
| 232 TEST( | 232 TEST( |
| 233 UnsafeSVGAttributeSanitizationTest, | 233 UnsafeSVGAttributeSanitizationTest, |
| 234 isJavaScriptURLAttribute_xlinkHrefContainingJavascriptURL_alternatePrefix) | 234 isJavaScriptURLAttribute_xlinkHrefContainingJavascriptURL_alternatePrefix) |
| 235 { | 235 { |
| 236 QualifiedName hrefAlternatePrefix( | 236 QualifiedName hrefAlternatePrefix( |
| 237 "foo", "href", XLinkNames::xlinkNamespaceURI); | 237 "foo", "href", XLinkNames::xlinkNamespaceURI); |
| 238 Attribute evilAttribute(hrefAlternatePrefix, "javascript:alert()"); | 238 Attribute evilAttribute(hrefAlternatePrefix, "javascript:alert()"); |
| 239 RefPtrWillBeRawPtr<Document> document = Document::create(); | 239 RawPtr<Document> document = Document::create(); |
| 240 RefPtrWillBeRawPtr<Element> element = SVGAElement::create(*document); | 240 RawPtr<Element> element = SVGAElement::create(*document); |
| 241 EXPECT_TRUE(element->isJavaScriptURLAttribute(evilAttribute)) << | 241 EXPECT_TRUE(element->isJavaScriptURLAttribute(evilAttribute)) << |
| 242 "The XLink 'href' attribute with a JavaScript URL value should be " | 242 "The XLink 'href' attribute with a JavaScript URL value should be " |
| 243 "identified as a JavaScript URL attribute, even if the attribute " | 243 "identified as a JavaScript URL attribute, even if the attribute " |
| 244 "doesn't use the typical 'xlink' prefix."; | 244 "doesn't use the typical 'xlink' prefix."; |
| 245 } | 245 } |
| 246 | 246 |
| 247 TEST( | 247 TEST( |
| 248 UnsafeSVGAttributeSanitizationTest, | 248 UnsafeSVGAttributeSanitizationTest, |
| 249 isSVGAnimationAttributeSettingJavaScriptURL_fromContainingJavaScriptURL) | 249 isSVGAnimationAttributeSettingJavaScriptURL_fromContainingJavaScriptURL) |
| 250 { | 250 { |
| 251 Attribute evilAttribute(SVGNames::fromAttr, "javascript:alert()"); | 251 Attribute evilAttribute(SVGNames::fromAttr, "javascript:alert()"); |
| 252 RefPtrWillBeRawPtr<Document> document = Document::create(); | 252 RawPtr<Document> document = Document::create(); |
| 253 RefPtrWillBeRawPtr<Element> element = SVGAnimateElement::create(*document); | 253 RawPtr<Element> element = SVGAnimateElement::create(*document); |
| 254 EXPECT_TRUE( | 254 EXPECT_TRUE( |
| 255 element->isSVGAnimationAttributeSettingJavaScriptURL(evilAttribute)) << | 255 element->isSVGAnimationAttributeSettingJavaScriptURL(evilAttribute)) << |
| 256 "The animate element should identify a 'from' attribute with a " | 256 "The animate element should identify a 'from' attribute with a " |
| 257 "JavaScript URL value as setting a JavaScript URL."; | 257 "JavaScript URL value as setting a JavaScript URL."; |
| 258 } | 258 } |
| 259 | 259 |
| 260 TEST( | 260 TEST( |
| 261 UnsafeSVGAttributeSanitizationTest, | 261 UnsafeSVGAttributeSanitizationTest, |
| 262 isSVGAnimationAttributeSettingJavaScriptURL_toContainingJavaScripURL) | 262 isSVGAnimationAttributeSettingJavaScriptURL_toContainingJavaScripURL) |
| 263 { | 263 { |
| 264 Attribute evilAttribute(SVGNames::toAttr, "javascript:window.close()"); | 264 Attribute evilAttribute(SVGNames::toAttr, "javascript:window.close()"); |
| 265 RefPtrWillBeRawPtr<Document> document = Document::create(); | 265 RawPtr<Document> document = Document::create(); |
| 266 RefPtrWillBeRawPtr<Element> element = SVGSetElement::create(*document); | 266 RawPtr<Element> element = SVGSetElement::create(*document); |
| 267 EXPECT_TRUE( | 267 EXPECT_TRUE( |
| 268 element->isSVGAnimationAttributeSettingJavaScriptURL(evilAttribute)) << | 268 element->isSVGAnimationAttributeSettingJavaScriptURL(evilAttribute)) << |
| 269 "The set element should identify a 'to' attribute with a JavaScript " | 269 "The set element should identify a 'to' attribute with a JavaScript " |
| 270 "URL value as setting a JavaScript URL."; | 270 "URL value as setting a JavaScript URL."; |
| 271 } | 271 } |
| 272 | 272 |
| 273 TEST( | 273 TEST( |
| 274 UnsafeSVGAttributeSanitizationTest, | 274 UnsafeSVGAttributeSanitizationTest, |
| 275 isSVGAnimationAttributeSettingJavaScriptURL_valuesContainingJavaScriptURL) | 275 isSVGAnimationAttributeSettingJavaScriptURL_valuesContainingJavaScriptURL) |
| 276 { | 276 { |
| 277 Attribute evilAttribute(SVGNames::valuesAttr, "hi!; javascript:confirm()"); | 277 Attribute evilAttribute(SVGNames::valuesAttr, "hi!; javascript:confirm()"); |
| 278 RefPtrWillBeRawPtr<Document> document = Document::create(); | 278 RawPtr<Document> document = Document::create(); |
| 279 RefPtrWillBeRawPtr<Element> element = SVGAnimateElement::create(*document); | 279 RawPtr<Element> element = SVGAnimateElement::create(*document); |
| 280 element = SVGAnimateElement::create(*document); | 280 element = SVGAnimateElement::create(*document); |
| 281 EXPECT_TRUE( | 281 EXPECT_TRUE( |
| 282 element->isSVGAnimationAttributeSettingJavaScriptURL(evilAttribute)) << | 282 element->isSVGAnimationAttributeSettingJavaScriptURL(evilAttribute)) << |
| 283 "The animate element should identify a 'values' attribute with a " | 283 "The animate element should identify a 'values' attribute with a " |
| 284 "JavaScript URL value as setting a JavaScript URL."; | 284 "JavaScript URL value as setting a JavaScript URL."; |
| 285 } | 285 } |
| 286 | 286 |
| 287 TEST( | 287 TEST( |
| 288 UnsafeSVGAttributeSanitizationTest, | 288 UnsafeSVGAttributeSanitizationTest, |
| 289 isSVGAnimationAttributeSettingJavaScriptURL_innocuousAnimationAttribute) | 289 isSVGAnimationAttributeSettingJavaScriptURL_innocuousAnimationAttribute) |
| 290 { | 290 { |
| 291 Attribute fineAttribute(SVGNames::fromAttr, "hello, world!"); | 291 Attribute fineAttribute(SVGNames::fromAttr, "hello, world!"); |
| 292 RefPtrWillBeRawPtr<Document> document = Document::create(); | 292 RawPtr<Document> document = Document::create(); |
| 293 RefPtrWillBeRawPtr<Element> element = SVGSetElement::create(*document); | 293 RawPtr<Element> element = SVGSetElement::create(*document); |
| 294 EXPECT_FALSE( | 294 EXPECT_FALSE( |
| 295 element->isSVGAnimationAttributeSettingJavaScriptURL(fineAttribute)) << | 295 element->isSVGAnimationAttributeSettingJavaScriptURL(fineAttribute)) << |
| 296 "The animate element should not identify a 'from' attribute with an " | 296 "The animate element should not identify a 'from' attribute with an " |
| 297 "innocuous value as setting a JavaScript URL."; | 297 "innocuous value as setting a JavaScript URL."; |
| 298 } | 298 } |
| 299 | 299 |
| 300 } // namespace blink | 300 } // namespace blink |
| OLD | NEW |